chore(deps): consolidate dependabot into one grouped PR, minor/patch only

[3uzbcqje]

Part of an org-wide Dependabot consolidation. This repo currently has 30 open Dependabot PRs.

What changes

1. Routine updates are minor/patch only — ignore drops version-update:semver-major. That prefix scopes the ignore to version updates, so a security advisory whose only fix is a major bump still opens a PR. Removing the update-types: key would make it a blanket ignore that silences security updates too; there's a comment in the file saying so.

2. One PR instead of one per dependency. multi-ecosystem-groups merges npm + bundler + docker + docker-compose + github-actions into a single weekly PR.

3. Security advisories grouped separately via *-security groups with applies-to: security-updates — one PR per ecosystem rather than one per advisory.

Already proven in this org

Running on alaska-rcv (15 PRs → 1), star-view (7 → 1), star-core (5 → 1), starpy and discord-bot.

On star-view, Dependabot took the majors down to the highest in-range version rather than skipping them: react 16.12.0→19.2.8 became 16.12.0→16.14.0, typescript 3.8.3→7.0.2 became 3.8.3→3.9.10.

Two rules learned the hard way, both encoded in the config:

• open-pull-requests-limit must not appear on an update entry belonging to a multi-ecosystem group — Dependabot rejects the whole file, and the published JSON schema does not catch it.
• A multi-ecosystem group has no applies-to key, so it covers version updates only. Hence the separate *-security groups.

What happens to the existing PRs

Mostly nothing — Dependabot cleans up after itself. Once this merges, it supersedes its own stale PRs and folds them into the grouped PR automatically. On star-view it closed 7 and replaced them with 1, unprompted.

The exception is PRs whose package has no in-range update left (an orphaned actions/checkout 4→7, say). Those linger and need closing by hand.

This repo has 14 open security alerts. Nothing here will be closed without first cross-referencing every PR against those alerts — see below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FpuRSSAYEkdSSgnaFaoBKK

[netlify]

✅ Deploy Preview for bettervoting ready!

Name	Link
🔨 Latest commit	2df4bcc
🔍 Latest deploy log	https://app.netlify.com/projects/bettervoting/deploys/6aa73b1dc7bf4500086137ed
😎 Deploy Preview	https://deploy-preview-1646--bettervoting.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2b0593a9-76bd-4595-bb92-0902d1b3965a

📥 Commits

Reviewing files that changed from the base of the PR and between 6d9c8db and 2df4bcc.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Streamlined automated dependency update management into a unified weekly update process.
  • Routine updates are now limited to minor and patch versions; major-version updates are excluded from automatic updates.
  • Security-related dependency updates continue to be handled separately.
  • Updated guidance clarifies the dependency update policy and grouping behavior.

Walkthrough

The Dependabot configuration now uses one weekly all-dependencies multi-ecosystem group for routine updates. The npm, Bundler, Docker, Docker Compose, and GitHub Actions entries use wildcard dependency patterns and ignore major version updates. Per-ecosystem security groups remain separate. Per-ecosystem schedules, pull request limits, and non-security routine groups were removed. The comments document these policies and the ecosystem-specific cooldown behavior.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 2df4b

The configuration preserves Dependabot security updates, including fixes requiring major versions. No merge-blocking issue was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: consolidating Dependabot updates and limiting routine updates to minor and patch versions.
Description check	✅ Passed	The description gives detailed context, explains the configuration changes, documents security-update handling, and notes operational effects. The template headings for Description and Related Issues …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-consolidate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit sees updates hop in one neat line
Five ecosystems gather on schedule and time
Major leaps wait while small steps proceed
Security groups stay set aside as agreed
The burrowed config now keeps its design}

_{Comment @coderabbitai help to get the list of available commands.}